Code Injection Detection via Dynamic Instruction Set Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are vulnerable to code injection attacks, particularly in homogeneous environments where attackers can easily craft machine code payloads due to known instruction sets, and existing solutions like Instruction Set Randomization are temporary and can be bypassed if the randomization value is discovered.
Innovation Solution
Implementing a method that detects illegal instruction errors, records them, and generates an alert if a threshold condition is met, using techniques like neural or Bayesian networks, and providing synthetic processing diversity by loading and switching between multiple instruction streams encoded in different instruction sets to increase architectural diversity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Instruction Set Randomization is used to obfuscate the underlying instruction set, then code injection attacks are temporarily mitigated, but the security is compromised if the randomization value is discovered
Solution Approach 1:
The system dynamically switches between multiple instruction set architectures (ISAs) at runtime, making the target architecture unpredictable to attackers. This dynamic switching prevents attackers from crafting effective payloads since they cannot know which ISA will be active when the attack occurs.
Solution Approach 2:
The system employs a composite security approach by combining multiple ISAs (x86, x86-64, ARM, MIPS, PowerPC) within a single homogeneous hardware platform. This creates a heterogeneous computing environment that leverages the strengths of different architectures while maintaining hardware uniformity.
2Reliability
If hardware diversity is increased to mitigate code injection attacks, then security is improved, but cost and environmental constraints are violated
Solution Approach 1:
A single homogeneous processor platform is made multi-functional by implementing support for multiple instruction set architectures. The same physical hardware can execute different ISAs through software-based translation and emulation layers, eliminating the need for multiple specialized hardware systems.
Solution Approach 2:
The system creates virtual copies of different processor architectures through software emulation. Instead of duplicating physical hardware for each ISA, virtual machine instances emulate different architectures, providing architectural diversity without additional physical infrastructure.
3Measurement precision
If multiple instruction streams are loaded and switched between to provide synthetic processing diversity, then code injection detection is improved, but processing overhead increases
Solution Approach 1:
Multiple instruction streams are pre-loaded into memory before execution begins. The system prepares alternative instruction sequences in advance, allowing rapid switching without the overhead of dynamic generation or compilation during runtime.
Solution Approach 2:
The system replaces complex hardware-based architecture switching with software-based instruction stream selection. Instead of physically changing processor components, the software layer selects and switches between pre-prepared instruction streams that emulate different architectures.
Data Source
AI summary
A method for detecting foreign code injected into a computer system including a processor and memory, the processor being configured to execute instructions stored in the memory, includes: detecting, on the computer system, an illegal instruction error; recording the illegal instruction error; determining whether a threshold condition is met; and generating an alert if the threshold condition is met.